Multi-bit watermarking embeds a message, typically an account identifier, into LLM output so that harmful text can be traced to its origin. We show an attack technique that allows to alter the watermarking message. This allows to, for example, exchange the embedded account ID to an arbitrary different one. The attacker...
Pawe{\l} Batorski, Przemys{\l}aw Spurek, Paul Swoboda· 0 citations
Agent harnesses require a low-latency guardrail model together with customizable audit policies. However, deploying an auto-regressive guardrail model remains challenging: such models incur high inference latency and are often poorly aligned with customized policies. To address these problems, we present Jev-Guard, a u...
Wenbin Hu, Huihao Jing, Haochen Shi et al.· 0 citations
As large language models are deployed behind increasingly sophisticated safety mechanisms, evaluating their robustness under realistic adversarial conditions becomes increasingly difficult and critical. Existing jailbreaking evaluations often rely on static prompts, limited interaction horizons, or lightly protected sy...
Md Mushfiqur Rahman, Tobias Rohde, R. Tripathi et al.· 0 citations
Long-term memory enables LLM agents to learn from past interactions but exposes memory formation to adversarial influence. Existing studies primarily organize memory poisoning by attack channels, corruption patterns, or lifecycle stages, leaving formation interfaces insufficiently characterized. We formulate Memory For...
Haowen Pan, Pengyang Shao, Yun-Shan Ma et al.· 0 citations
Reach audiences
Advertise in front of researchers, engineers, and readers.
We introduce Tokenization-Invariant Watermarking (TI-WM), a method that embeds a watermark during token generation but keys and scores it on canonicalized UTF-8 bytes. The detector does not invoke the tokenizer. Canonicalizer-preserving edits leave its score unchanged; other localized canonical-byte edits affect a boun...
RogueMerge is presented, the first unified attack framework addressing all three challenges of model merging: autoregressive generation, static arithmetic with a joint optimization that explicitly enforces attack success after merging, and attack injection as a stochastic min-max optimization problem and solve it via m...
Jing-Huai Zhang, Ye He, Kun-Lin Cai et al.· arXiv.org· 1 citation
Identification of anomalous events within system logs constitutes a pivotal element within the frame- work of cybersecurity defense strategies. However, this process faces numerous challenges, including the management of substantial data volumes, the distribution of anomalies, and the precision of con- ventional method...
In this paper, we introduce a simple yet effective tabular data watermarking mechanism with statistical guarantees. We show theoretically that the proposed watermark can be effectively detected, while faithfully preserving the data fidelity, and also demonstrates appealing robustness against additive noise attack. The...
Hengzhi He, Peiyu Yu, Junpeng Ren et al.· 0 citations
Under GRPO training, the hardened judge eliminates the reward-collapse failures (false-positive spikes and length collapse) the authors observe in the unhardened baseline on both MATH and GSM8K at ten seeds per condition.
Differentially private (DP) synthetic data enables the use of sensitive datasets while providing strong privacy guarantees. Recently, Private Evolution (PE) has emerged as a promising framework for generating DP synthetic data using only inference APIs of foundation models. However, suitable foundation models are not a...
Zinan Lin, Tadas Baltrusaitis, Wenyu Wang et al.· 0 citations
This paper proposes an Autonomous Cyber Operations (ACO) gym, a unified framework integrating high-fidelity network emulation, realistic user behaviour modelling for benign network traffic and adversarial profiles, and the generation of cybersecurity scenarios through open toolkits. By supporting live and deferred feat...
Tobias H\"urten, Johannes F. Loevenich, Florian Spelter et al.· 0 citations
The safety of LLM-based agents currently rests on alignment training and safety classifiers, neither of which can rule out that a sophisticated indirect prompt injection (IPI) goes through and causes significant harm. Recent work therefore builds agents with information-flow guarantees that rely on structured tool inte...
Research Manager Mike Walker reflects on a career spanning hacker culture, cybersecurity, and AI, sharing lessons about trust, teamwork, leadership, and why solving difficult problems requires curiosity, judgment, agility—and an understanding of the rules. The post Learn the rules: The hacker mindset appeared first on Microsoft Research.
Critical flaws, compromised release channels and agentic AI threats landed within days of each other in mid-October 2026. Why “Black October” may say more about how well we now find weaknesses than about the attacks themselves. The post Black October? The Week AI Changed the Cybersecurity Conversation appeared first on GPT-Lab.
